Google Had an Undercover Analyst Inside TeamPCP as Hackers Breached a Thousand Companies

A Google analyst sat inside a hacking crew's private chat while the group tore through a thousand companies.

Austin Larsen of Google Threat Intelligence Group told WIRED that a Mandiant persona joined TeamPCP's roughly 12-person CanisterWorm room from about March, after months of building trust with an invited actor. Larsen said the analyst was a fly on the wall, with guardrails and no illegal hacking. Neither of the two men later arrested has been convicted.

TeamPCP's cascading campaign hit open-source and vendor targets including Trivy, LiteLLM, Checkmarx, TanStack, and Mistral AI infrastructure. Public reporting also named GitHub, Mercor, OpenAI employee devices, the European Commission, and many unnamed organizations. A Dune-themed worm called Mini Shai-Hulud automated the scale-up.

Google accessed a server of stolen credentials, notified AWS and Microsoft first so those providers could revoke access at scale, then emailed hundreds of victims. Visibility into the chat also let Google intercept an AI-assisted zero-day against a widely used login product that bypassed two-factor authentication. Google tested the exploit, warned the vendor, and got a patch. A May Google case study described that incident without naming TeamPCP.

Late last month the Australian Federal Police, with FBI assistance, arrested Ruben Ian Thomson and Louis Michael Gaebler, Australians in their early twenties, as alleged principal participants. The AFP said the haul included more than half a million users' credentials. Larsen estimates TeamPCP took only tens of thousands of dollars in extortion, not millions.

ShinyHunters partnered with TeamPCP, then went rogue, shared a full chat log with Larsen unsolicited, and taunted the group in public. TeamPCP purged its circle and ejected Google's mole.

Larsen later followed an identity trail from a BreachForums leak that tied a CanisterWorm handle to a personal Gmail, a PayPal refund, and an illicit server backed up to the same Google Drive, then tipped the FBI. Other researchers, including Brian Krebs, also published identity clues. The AFP and FBI ran the arrests.

Some offers on this page may be paid placements or contain affiliate links.